TypeScript Vulnerability Checks

Tools for checking vulnerabilities in TypeScript/JavaScript code.


npm audit

 1# Check vulnerabilities
 2npm audit
 3
 4# Fix automatically
 5npm audit fix
 6
 7# Force fix (may break)
 8npm audit fix --force
 9
10# JSON output
11npm audit --json

Snyk

 1# Install
 2npm install -g snyk
 3
 4# Authenticate
 5snyk auth
 6
 7# Test project
 8snyk test
 9
10# Monitor project
11snyk monitor
12
13# Fix vulnerabilities
14snyk fix

ESLint Security Plugin

 1# Install
 2npm install --save-dev eslint-plugin-security
 3
 4# .eslintrc.json
 5{
 6  "plugins": ["security"],
 7  "extends": ["plugin:security/recommended"]
 8}
 9
10# Run
11npx eslint .

CI/CD Integration

 1# GitHub Actions
 2name: Security Scan
 3
 4on: [push, pull_request]
 5
 6jobs:
 7  security:
 8    runs-on: ubuntu-latest
 9    steps:
10      - uses: actions/checkout@v3
11      
12      - name: Set up Node
13        uses: actions/setup-node@v3
14        with:
15          node-version: '18'
16      
17      - name: Install dependencies
18        run: npm ci
19      
20      - name: Run npm audit
21        run: npm audit --audit-level=moderate
22      
23      - name: Run Snyk
24        uses: snyk/actions/node@master
25        env:
26          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}

Related Snippets